<!doctype html>

<html>
<head>
  <link rel="shortcut icon" href="static/images/favicon.ico" type="image/x-icon">
  <title>safehtml_test.js (Closure Library API Documentation - JavaScript)</title>
  <link rel="stylesheet" href="static/css/base.css">
  <link rel="stylesheet" href="static/css/doc.css">
  <link rel="stylesheet" href="static/css/sidetree.css">
  <link rel="stylesheet" href="static/css/prettify.css">

  <script>
     var _staticFilePath = "static/";
     var _typeTreeName = "goog";
     var _fileTreeName = "Source";
  </script>

  <script src="static/js/doc.js">
  </script>


  <meta charset="utf8">
</head>

<body onload="grokdoc.onLoad();">

<div id="header">
  <div class="g-section g-tpl-50-50 g-split">
    <div class="g-unit g-first">
      <a id="logo" href="index.html">Closure Library API Documentation</a>
    </div>

    <div class="g-unit">
      <div class="g-c">
        <strong>Go to class or file:</strong>
        <input type="text" id="ac">
      </div>
    </div>
  </div>
</div>

<div class="clear"></div>

<h2><a href="local_closure_goog_html_safehtml_test.js.html">safehtml_test.js</a></h2>

<pre class="prettyprint lang-js">
<a name="line1"></a>// Copyright 2013 The Closure Library Authors. All Rights Reserved.
<a name="line2"></a>//
<a name="line3"></a>// Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
<a name="line4"></a>// you may not use this file except in compliance with the License.
<a name="line5"></a>// You may obtain a copy of the License at
<a name="line6"></a>//
<a name="line7"></a>//      http://www.apache.org/licenses/LICENSE-2.0
<a name="line8"></a>//
<a name="line9"></a>// Unless required by applicable law or agreed to in writing, software
<a name="line10"></a>// distributed under the License is distributed on an &quot;AS-IS&quot; BASIS,
<a name="line11"></a>// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
<a name="line12"></a>// See the License for the specific language governing permissions and
<a name="line13"></a>// limitations under the License.
<a name="line14"></a>
<a name="line15"></a>/**
<a name="line16"></a> * @fileoverview Unit tests for goog.html.SafeHtml and its builders.
<a name="line17"></a> */
<a name="line18"></a>
<a name="line19"></a>goog.provide(&#39;goog.html.safeHtmlTest&#39;);
<a name="line20"></a>
<a name="line21"></a>goog.require(&#39;goog.html.SafeHtml&#39;);
<a name="line22"></a>goog.require(&#39;goog.html.SafeUrl&#39;);
<a name="line23"></a>goog.require(&#39;goog.html.testing&#39;);
<a name="line24"></a>goog.require(&#39;goog.html.uncheckedconversions&#39;);
<a name="line25"></a>goog.require(&#39;goog.i18n.bidi.Dir&#39;);
<a name="line26"></a>goog.require(&#39;goog.string.Const&#39;);
<a name="line27"></a>goog.require(&#39;goog.testing.jsunit&#39;);
<a name="line28"></a>
<a name="line29"></a>goog.setTestOnly(&#39;goog.html.safeHtmlTest&#39;);
<a name="line30"></a>
<a name="line31"></a>
<a name="line32"></a>
<a name="line33"></a>function testSafeHtml() {
<a name="line34"></a>  // TODO(user): Consider using SafeHtmlBuilder instead of newSafeHtmlForTest,
<a name="line35"></a>  // when available.
<a name="line36"></a>  var safeHtml = goog.html.testing.newSafeHtmlForTest(&#39;Hello &lt;em&gt;World&lt;/em&gt;&#39;);
<a name="line37"></a>  assertSameHtml(&#39;Hello &lt;em&gt;World&lt;/em&gt;&#39;, safeHtml);
<a name="line38"></a>  assertEquals(&#39;Hello &lt;em&gt;World&lt;/em&gt;&#39;, safeHtml.getTypedStringValue());
<a name="line39"></a>  assertEquals(&#39;SafeHtml{Hello &lt;em&gt;World&lt;/em&gt;}&#39;, String(safeHtml));
<a name="line40"></a>  assertNull(safeHtml.getDirection());
<a name="line41"></a>
<a name="line42"></a>  safeHtml = goog.html.testing.newSafeHtmlForTest(
<a name="line43"></a>      &#39;World &lt;em&gt;Hello&lt;/em&gt;&#39;, goog.i18n.bidi.Dir.RTL);
<a name="line44"></a>  assertSameHtml(&#39;World &lt;em&gt;Hello&lt;/em&gt;&#39;, safeHtml);
<a name="line45"></a>  assertEquals(&#39;World &lt;em&gt;Hello&lt;/em&gt;&#39;, safeHtml.getTypedStringValue());
<a name="line46"></a>  assertEquals(&#39;SafeHtml{World &lt;em&gt;Hello&lt;/em&gt;}&#39;, String(safeHtml));
<a name="line47"></a>  assertEquals(goog.i18n.bidi.Dir.RTL, safeHtml.getDirection());
<a name="line48"></a>
<a name="line49"></a>  // Interface markers are present.
<a name="line50"></a>  assertTrue(safeHtml.implementsGoogStringTypedString);
<a name="line51"></a>  assertTrue(safeHtml.implementsGoogI18nBidiDirectionalString);
<a name="line52"></a>
<a name="line53"></a>  // Pre-defined constant.
<a name="line54"></a>  assertSameHtml(&#39;&#39;, goog.html.SafeHtml.EMPTY);
<a name="line55"></a>}
<a name="line56"></a>
<a name="line57"></a>
<a name="line58"></a>/** @suppress {checkTypes} */
<a name="line59"></a>function testUnwrap() {
<a name="line60"></a>  var evil = {};
<a name="line61"></a>  evil.safeHtmlValueWithSecurityContract__googHtmlSecurityPrivate_ =
<a name="line62"></a>      &#39;&lt;script&gt;evil()&lt;/script&#39;;
<a name="line63"></a>  evil.SAFE_HTML_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
<a name="line64"></a>
<a name="line65"></a>  var exception = assertThrows(function() {
<a name="line66"></a>    goog.html.SafeHtml.unwrap(evil);
<a name="line67"></a>  });
<a name="line68"></a>  assertTrue(exception.message.indexOf(&#39;expected object of type SafeHtml&#39;) &gt; 0);
<a name="line69"></a>}
<a name="line70"></a>
<a name="line71"></a>
<a name="line72"></a>function testSafeHtmlFromEscapedText() {
<a name="line73"></a>  // TODO(user): goog.string.htmlEscape currently doesn&#39;t escape single-quotes.
<a name="line74"></a>  // It should.  Include that in the test once it does.
<a name="line75"></a>  var safeHtml = goog.html.SafeHtml.htmlEscape(&#39;Hello &lt;em&gt;&quot;&amp;World&lt;/em&gt;&#39;);
<a name="line76"></a>  assertSameHtml(&#39;Hello &amp;lt;em&amp;gt;&amp;quot;&amp;amp;World&amp;lt;/em&amp;gt;&#39;, safeHtml);
<a name="line77"></a>  assertEquals(&#39;SafeHtml{Hello &amp;lt;em&amp;gt;&amp;quot;&amp;amp;World&amp;lt;/em&amp;gt;}&#39;,
<a name="line78"></a>      String(safeHtml));
<a name="line79"></a>}
<a name="line80"></a>
<a name="line81"></a>
<a name="line82"></a>function testSafeHtmlFrom() {
<a name="line83"></a>  // goog.html.SafeHtml passes through .from unchanged.
<a name="line84"></a>  var safeHtmlIn = goog.html.SafeHtml.htmlEscape(&#39;&lt;b&gt;in&lt;/b&gt;&#39;);
<a name="line85"></a>  assertTrue(safeHtmlIn === goog.html.SafeHtml.from(safeHtmlIn));
<a name="line86"></a>
<a name="line87"></a>  // Plain strings are escaped.
<a name="line88"></a>  assertSameHtml(&#39;this &amp;amp; that&#39;, goog.html.SafeHtml.from(&#39;this &amp; that&#39;));
<a name="line89"></a>
<a name="line90"></a>  // Creating from a SafeUrl escapes and retains the known direction (which is
<a name="line91"></a>  // fixed to RTL for URLs).
<a name="line92"></a>  var safeUrl = goog.html.SafeUrl.fromConstant(
<a name="line93"></a>      goog.string.Const.from(&#39;http://example.com/?foo&amp;bar&#39;));
<a name="line94"></a>  var escapedUrl = goog.html.SafeHtml.from(safeUrl);
<a name="line95"></a>  assertSameHtml(&#39;http://example.com/?foo&amp;amp;bar&#39;, escapedUrl);
<a name="line96"></a>  assertEquals(goog.i18n.bidi.Dir.LTR, escapedUrl.getDirection());
<a name="line97"></a>
<a name="line98"></a>  // Creating SafeHtml from a goog.string.Const escapes as well (i.e., the
<a name="line99"></a>  // value is treated like any other string). To create HTML markup from
<a name="line100"></a>  // program literals, SafeHtmlBuilder should be used.
<a name="line101"></a>  assertSameHtml(&#39;this &amp;amp; that&#39;,
<a name="line102"></a>      goog.html.SafeHtml.from(
<a name="line103"></a>          goog.string.Const.from(&#39;this &amp; that&#39;)));
<a name="line104"></a>}
<a name="line105"></a>
<a name="line106"></a>
<a name="line107"></a>function testSafeHtmlUncheckedConversion() {
<a name="line108"></a>  var safeHtml =
<a name="line109"></a>      goog.html.uncheckedconversions.
<a name="line110"></a>          safeHtmlFromStringKnownToSatisfyTypeContract(
<a name="line111"></a>              goog.string.Const.from(
<a name="line112"></a>                  &#39;Safe because value is constant and ends in inner HTML. &#39; +
<a name="line113"></a>                  &#39;Security review: b/7685625.&#39;),
<a name="line114"></a>              &#39;Hello &lt;em&gt;World&lt;/em&gt;&#39;);
<a name="line115"></a>  assertSameHtml(&#39;Hello &lt;em&gt;World&lt;/em&gt;&#39;, safeHtml);
<a name="line116"></a>  assertEquals(&#39;SafeHtml{Hello &lt;em&gt;World&lt;/em&gt;}&#39;, String(safeHtml));
<a name="line117"></a>}
<a name="line118"></a>
<a name="line119"></a>
<a name="line120"></a>function testSafeHtmlCreate() {
<a name="line121"></a>  var br = goog.html.SafeHtml.create(&#39;br&#39;);
<a name="line122"></a>
<a name="line123"></a>  assertSameHtml(&#39;&lt;br&gt;&#39;, br);
<a name="line124"></a>
<a name="line125"></a>  assertSameHtml(&#39;&lt;span title=&quot;&amp;quot;&quot;&gt;&lt;/span&gt;&#39;,
<a name="line126"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {&#39;title&#39;: &#39;&quot;&#39;}));
<a name="line127"></a>
<a name="line128"></a>  assertSameHtml(&#39;&lt;span&gt;&amp;lt;&lt;/span&gt;&#39;,
<a name="line129"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {}, &#39;&lt;&#39;));
<a name="line130"></a>
<a name="line131"></a>  assertSameHtml(&#39;&lt;span&gt;&lt;br&gt;&lt;/span&gt;&#39;,
<a name="line132"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {}, br));
<a name="line133"></a>
<a name="line134"></a>  assertSameHtml(&#39;&lt;span&gt;&lt;/span&gt;&#39;, goog.html.SafeHtml.create(&#39;span&#39;, {}, []));
<a name="line135"></a>
<a name="line136"></a>  assertSameHtml(&#39;&lt;span&gt;&lt;/span&gt;&#39;,
<a name="line137"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {&#39;title&#39;: null, &#39;class&#39;: undefined}));
<a name="line138"></a>
<a name="line139"></a>  assertSameHtml(&#39;&lt;span&gt;x&lt;br&gt;y&lt;/span&gt;&#39;,
<a name="line140"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {}, [&#39;x&#39;, br, &#39;y&#39;]));
<a name="line141"></a>
<a name="line142"></a>  var onclick = goog.string.Const.from(&#39;alert(/&quot;/)&#39;);
<a name="line143"></a>  assertSameHtml(&#39;&lt;span onclick=&quot;alert(/&amp;quot;/)&quot;&gt;&lt;/span&gt;&#39;,
<a name="line144"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {&#39;onclick&#39;: onclick}));
<a name="line145"></a>
<a name="line146"></a>  var href = goog.html.testing.newSafeUrlForTest(&#39;?a&amp;b&#39;);
<a name="line147"></a>  assertSameHtml(&#39;&lt;a href=&quot;?a&amp;amp;b&quot;&gt;&lt;/a&gt;&#39;,
<a name="line148"></a>      goog.html.SafeHtml.create(&#39;a&#39;, {&#39;href&#39;: href}));
<a name="line149"></a>
<a name="line150"></a>  var style = goog.html.testing.newSafeStyleForTest(&#39;border: /* &quot; */ 0;&#39;);
<a name="line151"></a>  assertSameHtml(&#39;&lt;hr style=&quot;border: /* &amp;quot; */ 0;&quot;&gt;&#39;,
<a name="line152"></a>      goog.html.SafeHtml.create(&#39;hr&#39;, {&#39;style&#39;: style}));
<a name="line153"></a>
<a name="line154"></a>  assertEquals(goog.i18n.bidi.Dir.NEUTRAL,
<a name="line155"></a>      goog.html.SafeHtml.create(&#39;span&#39;).getDirection());
<a name="line156"></a>  assertNull(goog.html.SafeHtml.create(&#39;span&#39;, {&#39;dir&#39;: &#39;auto&#39;}).getDirection());
<a name="line157"></a>  assertEquals(goog.i18n.bidi.Dir.LTR,
<a name="line158"></a>      goog.html.SafeHtml.create(&#39;span&#39;, {&#39;dir&#39;: &#39;ltr&#39;}).getDirection());
<a name="line159"></a>
<a name="line160"></a>  assertThrows(function() {
<a name="line161"></a>    goog.html.SafeHtml.create(&#39;script&#39;);
<a name="line162"></a>  });
<a name="line163"></a>
<a name="line164"></a>  assertThrows(function() {
<a name="line165"></a>    goog.html.SafeHtml.create(&#39;br&#39;, {}, &#39;x&#39;);
<a name="line166"></a>  });
<a name="line167"></a>
<a name="line168"></a>  assertThrows(function() {
<a name="line169"></a>    goog.html.SafeHtml.create(&#39;img&#39;, {&#39;onerror&#39;: &#39;&#39;});
<a name="line170"></a>  });
<a name="line171"></a>
<a name="line172"></a>  assertThrows(function() {
<a name="line173"></a>    goog.html.SafeHtml.create(&#39;a&#39;, {&#39;href&#39;: &#39;javascript:alert(1)&#39;});
<a name="line174"></a>  });
<a name="line175"></a>
<a name="line176"></a>  assertThrows(function() {
<a name="line177"></a>    goog.html.SafeHtml.create(&#39;hr&#39;, {&#39;class&#39;: style});
<a name="line178"></a>  });
<a name="line179"></a>
<a name="line180"></a>  assertThrows(function() {
<a name="line181"></a>    goog.html.SafeHtml.create(&#39;a href=&quot;&quot;&#39;);
<a name="line182"></a>  });
<a name="line183"></a>
<a name="line184"></a>  assertThrows(function() {
<a name="line185"></a>    goog.html.SafeHtml.create(&#39;a&#39;, {&#39;title=&quot;&quot; href&#39;: &#39;&#39;});
<a name="line186"></a>  });
<a name="line187"></a>}
<a name="line188"></a>
<a name="line189"></a>
<a name="line190"></a>function testSafeHtmlConcat() {
<a name="line191"></a>  var br = goog.html.testing.newSafeHtmlForTest(&#39;&lt;br&gt;&#39;);
<a name="line192"></a>
<a name="line193"></a>  var html = goog.html.SafeHtml.htmlEscape(&#39;Hello&#39;);
<a name="line194"></a>  assertSameHtml(&#39;Hello&lt;br&gt;&#39;, goog.html.SafeHtml.concat(html, br));
<a name="line195"></a>
<a name="line196"></a>  assertSameHtml(&#39;&#39;, goog.html.SafeHtml.concat());
<a name="line197"></a>  assertSameHtml(&#39;&#39;, goog.html.SafeHtml.concat([]));
<a name="line198"></a>
<a name="line199"></a>  assertSameHtml(&#39;a&lt;br&gt;c&#39;, goog.html.SafeHtml.concat(&#39;a&#39;, br, &#39;c&#39;));
<a name="line200"></a>  assertSameHtml(&#39;a&lt;br&gt;c&#39;, goog.html.SafeHtml.concat([&#39;a&#39;, br, &#39;c&#39;]));
<a name="line201"></a>  assertSameHtml(&#39;a&lt;br&gt;c&#39;, goog.html.SafeHtml.concat(&#39;a&#39;, [br, &#39;c&#39;]));
<a name="line202"></a>  assertSameHtml(&#39;a&lt;br&gt;c&#39;, goog.html.SafeHtml.concat([&#39;a&#39;], br, [&#39;c&#39;]));
<a name="line203"></a>
<a name="line204"></a>  var ltr = goog.html.testing.newSafeHtmlForTest(&#39;&#39;, goog.i18n.bidi.Dir.LTR);
<a name="line205"></a>  var rtl = goog.html.testing.newSafeHtmlForTest(&#39;&#39;, goog.i18n.bidi.Dir.RTL);
<a name="line206"></a>  var neutral = goog.html.testing.newSafeHtmlForTest(&#39;&#39;,
<a name="line207"></a>      goog.i18n.bidi.Dir.NEUTRAL);
<a name="line208"></a>  var unknown = goog.html.testing.newSafeHtmlForTest(&#39;&#39;);
<a name="line209"></a>  assertEquals(goog.i18n.bidi.Dir.NEUTRAL,
<a name="line210"></a>      goog.html.SafeHtml.concat().getDirection());
<a name="line211"></a>  assertEquals(goog.i18n.bidi.Dir.LTR,
<a name="line212"></a>      goog.html.SafeHtml.concat(ltr, ltr).getDirection());
<a name="line213"></a>  assertEquals(goog.i18n.bidi.Dir.LTR,
<a name="line214"></a>      goog.html.SafeHtml.concat(ltr, neutral, ltr).getDirection());
<a name="line215"></a>  assertNull(goog.html.SafeHtml.concat(ltr, unknown).getDirection());
<a name="line216"></a>  assertNull(goog.html.SafeHtml.concat(ltr, rtl).getDirection());
<a name="line217"></a>  assertNull(goog.html.SafeHtml.concat(ltr, [rtl]).getDirection());
<a name="line218"></a>}
<a name="line219"></a>
<a name="line220"></a>
<a name="line221"></a>function assertSameHtml(expected, html) {
<a name="line222"></a>  assertEquals(expected, goog.html.SafeHtml.unwrap(html));
<a name="line223"></a>}
</pre>


</body>
</html>
